Tired of too many ads? Remove Ads
The Ministry of Electronics and Information Technology (MeitY) has completed perusing two-thirds of comments received during consultations on the draft DPDP Rules 2025, the official said, referring to the consultation process that began January 3.
"The study of the remaining one-third of the comments will be finished soon, and we should be able to finalise the rules by the end of next month," the official said.
The DPDP rules are much awaited since they are essential for operationalising the DPDP Act passed by Parliament two years ago. This will bring the DPDP Act into effect with a transition time for the industry for implementation.
Data localisation is a key concern for the industry, in addition to issues pertaining to verifiable parental consent (VPC). The official, however, said the concerns are unfounded and that the provision may be used sparingly by the government, if at all.
Tired of too many ads? Remove Ads
Also Read: MeitY releases draft rules for DPDP Act; seeks comments from stakeholders
Popular in TechMore ?
Most industry bodies including Information Technology Industry (ITI) Council, Nasscom, Business Software Alliance (BSA), and Internet and Mobile Association of India (IAMAI) have submitted their feedback to MeitY on the draft rules, highlighting their concerns over data localisation provisions and requirements for verifiable parental consent.
Data localisation draws criticism
A key area of contention is Rule 12(4), which empowers the government to mandate data localisation for Significant Data Fiduciaries (SDFs).
ITI, Nasscom, BSA, and IAMAI have all expressed strong reservations about this provision. They argue that it contradicts DPDPA's "open by default" approach to international data transfers.
"This proposal, as it stands, risks causing unintended uncertainty on international data transfers. Moreover, the ability of such a restriction to afford meaningful additional safeguards to the processing of personal data, remains at best questionable," said Nasscom in its submission.
Industry bodies fear the localisation requirements could fragment global data flows, stifle innovation, and increase operational costs for businesses, impacting India's information technology (IT) and business process management (BPM) sectors. They urged MeitY to reconsider or significantly narrow the scope of Rule 12(4), emphasising the need for a transparent process, clear objectives, and industry consultation before any localisation mandates are imposed.
BSA, in its submission, recommended removing Rule 12(4) entirely and stated, "Such selective data localisation measures fragment global data transfers, stifle innovation, and impose unnecessary costs on businesses—without enhancing data protection or security goals."
Tired of too many ads? Remove Ads
"We note that such a requirement may apply to non-personal data as well as it pertains to ‘traffic data’ – thereby going beyond the scope of the DPDP Act," IAMAI said in its submission.
Such a provision can also run the risk of isolating Indian companies from global data trade by making it difficult for businesses to accrue the benefits of free flow of data, running counter to India’s ambitions of becoming a global data and AI leader, it said.
IAMAI emphasised that the Centre’s broader authority to notify any category of data for localisation without objective criteria or clear mechanisms will cause implementation uncertainties as firms handling personal data will face regular requirements for updating and revising data handling processes based on such notifications. This would inflate compliance costs, impacting efficiency of businesses and their ability to innovate.
In addition, requiring traffic data to be stored in India undermines and contradicts the Act’s intent, which is limited to regulation of personal data, it said. "The requirement to store traffic data in India means that even non-personal data will need to be stored in India. This deviates significantly from international best practices on the regulation of personal data," IAMAI said.
Verifiable parental consent: implementation challenges
The draft rules' provisions on verifiable parental consent for processing children's data (Rule 10) have also raised concerns. The DPDPA defines a child as anyone under 18, and the rules require data fiduciaries to obtain VPC before processing their data.
ITI, in its submission, highlighted the "significant technical implementation challenges," especially for smaller businesses and platforms. The industry body called for further talks to ensure the rules are workable and aligned with global best practices.
Also Read: DPDP Act draft rules: Social media users under 18 years to require parental consent
"Complex VPC rules require additional consultation. Age verification and the question of parental consent for children remains a complex area globally where there are technical challenges to ensure accuracy as well as data security," ITI said.
Industry bodies suggested aligning the age of consent with international standards, many of which set it between 13 and 16. They also advocated for clarifying that VPC should only be required when the data fiduciary has "actual knowledge" that it is processing children's data.
IAMAI expressed concern that requiring platforms to verify the identity of every user's parent/guardian could lead to "an onerous data maximisation approach" that goes against the principle of data minimisation.
Call for balanced approach
The submissions underscore the need for a balanced approach to data protection that safeguards individual privacy while fostering innovation and economic growth.
Industry bodies urged MeitY to engage in further consultation for addressing the identified concerns and ensure that the final rules are clear, implementable, and aligned with the objectives of the DPDPA.
